Towards a Nordic guide to efficient and secure access to health data for secondary use under the EHDS

Summary

The European Health Data Space Regulation, Regulation (EU) 2025/327, establishes a common European framework for the primary and secondary use of electronic health data. The secondary-use dimension (in this report the EHDS2) requires Member States to develop the legal, organisational, technical and governance capabilities needed to make health data available for permitted secondary-use purposes securely, transparently and efficiently.

The Value from Nordic health data project, VALO, was initiated and funded by the Nordic Council of Ministers to strengthen Nordic cooperation and support preparations for the implementation of the EHDS. Workstream 2 (WS2) contributed to this objective by establishing the Nordic EHDS2 Competence Forum, coordinating national progress reporting and enabling dedicated cooperation on organisational readiness, metadata, legal interpretation and ethical governance. This report consolidates the work and outcomes of WS2 and its expert groups.

From September 2024 to September 2026, eight Nordic EHDS2 Competence Forums were organised across the Nordic countries. Estonia and Lithuania participated as observers during the VALO2 extension, adding a wider Nordic-Baltic perspective. The Forums created a recurring, invitation-only setting in which ministries, authorities and experts could discuss implementation challenges, compare national approaches and develop practical responses.

Evaluations conducted after the Forums indicate that this format was highly valued by participants and support the conclusion that the Forum provided a trusting and useful environment for professional exchange and mutual learning.

Successful implementation of EHDS2 depends on coordinated readiness across multiple areas. Health Data Access Bodies, secure processing environments, metadata catalogues, health data holders, ethical review bodies and other relevant actors must form parts of a coherent end-to-end system. Legal, technical, organisational, ethical and metadata requirements should therefore not be addressed as isolated implementation tasks.

A central contribution of VALO2 is the use and further development of the secondary-use User Journey as a common organising framework. Building on the journeys developed through TEHDAS and TEHDAS2[1], VALO2 expands the framework upstream to include a pre-discovery and metadata publication phase and downstream to include data preparation, secure processing, analysis support, output release, archiving, reproducibility, publication and project closure – with associated recommendations for a smoother and more secure User Journey.

This expanded framework highlights the back-office capabilities that must exist before a data user can successfully discover and access data. These include identifying health data holders and datasets, producing and maintaining metadata, publishing records in national and European catalogues, assessing dataset suitability and study feasibility, processing applications, preparing and transferring data, onboarding users to secure processing environments, supporting analysis and controlling the release of results.

The metadata work demonstrates that HealthDCAT-AP remains difficult to interpret and implement consistently. Although the specification has matured and national understanding has improved, readiness remains uneven. Questions persist concerning the HealthDCAT-AP information model; the definition and granularity of datasets; the use of dataset series and distributions; the representation of different EHDS Article 51 data categories; and the interpretation of mandatory metadata properties.

Existing national health data catalogues generally require substantial adaptation to meet the EHDS requirements. The VALO2 work included mapping national catalogue properties to HealthDCAT-AP, piloting cancer registry descriptions, analysing the Nordic health data landscape under EHDS Article 51 and exploring metadata requirements for AI development and data-quality assessment.

The report recommends continued practical piloting, common Nordic examples and interpretations, more harmonised dataset definitions and further consideration of a Nordic HealthDCAT-AP extension. It also recommends developing a Nordic self-assessment tool to help organisations determine whether they qualify as health data holders and continuing the mapping of health data holders and datasets across all Article 51 categories.

Metadata quality is also identified as an important condition for AI-supported data discovery and responsible AI development. Structured, complete, standardised and regularly maintained metadata, including detailed variable-level information, can improve dataset discovery and help users assess provenance, availability, suitability and aspects of data quality. Current metadata and data-quality requirements, however, provide only a starting point for the more detailed assessments that may be needed for high-risk AI development.

The legal work examined selected EHDS provisions with practical significance for Nordic implementation. The participating experts reached common or broadly shared interpretations concerning statistical bodies as health data holders, certain organisational aspects of Health Data Intermediation Entities, the application of fee provisions and the scope of the Health Data Access Bodies assessments under Article 68(1)(b). These interpretations may support closer Nordic coordination but do not constitute formally adopted national positions.

Several important legal and operational questions remain unresolved. These include the allocation of the EHDS and GDPR responsibilities for Health Data Intermediation Entities; the practical handling of significant findings; national approaches to fees and incentives; opt-out mechanisms; protection of intellectual property rights and trade secrets; and the relationship between the EHDS consent provisions and national ethical requirements.

The report therefore recommends continued Nordic legal cooperation, with a clear distinction between legal interpretation, policy choices and operational guidance. Cooperation should focus particularly on areas where differing national approaches could create barriers to cross-border access or make the Nordic User Journey less predictable. Where appropriate, Nordic findings and questions should be brought jointly to the European level.

The ethical mapping demonstrates significant differences among the Nordic countries concerning whether ethical review is required. In Sweden, Norway and Iceland, ethical review is generally required for qualifying scientific or health research where the applicable data-related and territorial conditions are met. Denmark applies ethical-review requirements more narrowly, while Finland generally does not require a statutory ethical review solely because existing health data are used.

The distinction between quality assurance and scientific research, territorial scope, application-language requirements, competent authorities and procedural sequencing can materially affect multinational projects. The VALO2 pilot demonstrated the cumulative practical effect of these requirements. In Norway, classification of the project from quality assurance to scientific research changed the applicable regulatory pathway and contributed, together with subsequent requirements, to a delay of approximately five months.

The report recommends involving ethics committees and ethical expertise early in national and Nordic EHDS implementation. Applicants should have access to clear country-specific guidance on whether ethical review or related national procedures are required, which bodies are competent, what language requirements apply and how ethical procedures relate to the Health Data Access Body process. Continued Nordic exchange on the distinction between quality assurance and scientific research could improve predictability without replacing national law or the independence of competent authorities.

Across all implementation areas, the report recommends viewing the User Journey as a single interconnected process. Metadata publication, data discovery, feasibility assessment, applicant guidance, legal and ethical prerequisites, application processing, access decisions, data preparation, secure analysis, disclosure control and publication of results all depend on one another. A bottleneck in one area can delay or prevent progress in another.

Support functions should therefore be developed for each step of the journey and for all central actors, not only applicants. Health data holders need support in identifying datasets and preparing metadata. Applicants need support in discovering and assessing data, interpreting national requirements and preparing complete applications. Health Data Access Bodies need application-processing, coordination and decision-support capabilities. Secure processing environment operators need reliable procedures for data provision, onboarding, analysis support, monitoring, output control and project closure.

The overall recommendations are that the Nordic countries should jointly:

• maintain a Nordic-Baltic EHDS2 community of practice, building on the trusting environment and working methods established through the Competence Forum;
• map bottlenecks and develop support functions across the full User Journey;
• develop a harmonised health data holder self-assessment approach;
• continue practical HealthDCAT-AP implementation, common mapping, pilot descriptions and work towards more harmonised Nordic metadata practices;
• coordinate legal interpretations and national implementation choices where unnecessary divergence could obstruct cross-border access;
• improve transparency and cooperation concerning the ethical-review requirements, territorial scope, application-language requirements and the distinction between quality assurance and scientific research;
• develop common Nordic applicant-facing information, guidance and training, including English-language material for cross-border users;
• compare national support functions, fee models, secure processing arrangements and implementation costs; and
• monitor emerging concerns about AI, significant findings, opt-out mechanisms, intellectual property rights and trade secrets.

The report also proposes that the VALO outputs can be used as an implementation-readiness, gap-analysis and operational validation framework for secondary use according to the provisions of the EHDS Regulation. By mapping User Journey steps, actors, support functions and recommendations to the relevant EHDS provisions, the work can help national and Nordic actors assess whether the necessary capabilities are being established. Such use does not constitute a formal legal compliance assessment and must be complemented by legal review, technical conformity assessment and the final requirements established through implementing acts.

The report concludes that sustained Nordic-Baltic cooperation would strengthen the region’s capacity to implement the EHDS2 in a consistent, trustworthy and effective manner. A continuing community of practice – linked where appropriate to the proposed Nordic Health Data Competence Forum and wider Nordic Model – could connect policy makers, Health Data Access Bodies, secure processing environment operators, metadata specialists, legal advisers, ethics experts and other stakeholders. This would support cross-border research and innovation, reduce avoidable duplication and help ensure that Nordic and Baltic implementation experience contributes constructively to continuing European-level development.

[1] Second Joint Action Towards the European Health Data Space – TEHDAS2 – Tehdas